Splunk SME_ Remote

Splunk SME_ Remote Contract Required Qualifications' Bachelor s degree in computer science, Information Systems, Cybersecurity, or equivalent professional experience 5-8+ years of hands-on Splunk experience in enterprise environments 3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day) Deep expertise in Splunk Enterprise Security correlation search authoring, ES data models, risk-based alerting Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments Proven ability to create and maintain technical documentation runbooks, standards guides, architecture documentation Background in detection engineering, threat hunting, or SOC operations understanding of how knowledge objects serve analysts in practice Preferred Qualification's Splunk Certifications: Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin (SPLK-3001), Splunk Certified Architect one or more strongly preferred Security Certifications: GIAC (GCIA, GCIH, GCED), or equivalent Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration Familiarity with Splunk UBA and behavioral analytics model management Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI) Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention Familiarity with Kafka, streaming data pipelines, and real-time telemetry routing